CVE-2025-49641 - Insufficient permission check for the problem.view.refresh action

Back Back to CVE browser

MEDIUM

Insufficient permission check for the problem.view.refresh action

Published Oct 3, 2025

5.1

MEDIUM

CVSS 4.0

EPSS 0.29%

Description

A regular Zabbix user with no permission to the Monitoring -> Problems view is still able to call the problem.view.refresh action and therefore still retrieve a list of active problems.

Affected products

Vendor Zabbix Product Zabbix Default
unknown
Affected
- ≥ 6.0.0, ≤ 6.0.40
- ≥ 7.0.0, ≤ 7.0.17
- ≥ 7.2.0, ≤ 7.2.11
- ≥ 7.4.0, ≤ 7.4.1

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Zabbix	Zabbix	unknown	Affected ≥ 6.0.0, ≤ 6.0.40 ≥ 7.0.0, ≤ 7.0.17 ≥ 7.2.0, ≤ 7.2.11 ≥ 7.4.0, ≤ 7.4.1

Remediation

Vendor solution

Update the affected components to their respective fixed versions.

Weaknesses (1)

CWE-863

Incorrect Authorization

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-32548
Advisory
https://support.zabbix.com/browse/ZBX-27063
Vendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-32548		Advisory
https://support.zabbix.com/browse/ZBX-27063		Vendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner Zabbix

Published Oct 3, 2025

Updated Oct 3, 2025

Reserved Jun 9, 2025

Link CVE-2025-49641

CISA Vulnrichment

Updated Oct 3, 2025

NVD

Status Analyzed

Modified Jun 17, 2026

Link CVE-2025-49641

Red Hat

No data

ENISA EUVD

Assigner Zabbix

Published Oct 3, 2025

Updated Oct 3, 2025

Link EUVD-2025-32548

GitHub

No data